Skip to main content

Please log into UltraDNS for full Help Center and Community access

CAA for S/MIME Certificates: What It Means and How UltraDNS Supports It

Enrique Somoza
  • Community team
Edited

Starting in March 2025, Certificate Authorities (CAs) will be required to honor Certification Authority Authorization (CAA) records for S/MIME certificates, not just TLS/SSL. This change comes from the CA/Browser Forum and is documented in RFC 9495, which introduces a new CAA property tag: issuemail.

This is a significant shift for organizations that issue or manage email certificates—and it’s one that UltraDNS is ready for.

UltraDNS Support for S/MIME CAA Records

UltraDNS fully supports CAA records, including issuemail, giving customers a centralized and scalable way to manage which CAs are authorized to issue certificates for their domains. Whether you’re using certificates for websites, email, or Verified Mark Certificates (VMCs), UltraDNS helps enforce your issuance policies with precision.

Supported CAA Tags

UltraDNS supports all relevant tags:

  • issue: Authorizes a CA to issue certificates for a domain.
  • issuewild: Restricts which CAs can issue wildcard certificates.
  • issuemail: Authorizes CAs for S/MIME certificate issuance.
  • issuevmc: Authorizes CAs to issue VMCs for BIMI.
  • iodef: Enables reporting for policy violations.

The addition of issuemail brings the same level of control and security that organizations already rely on for web certificates to the world of email.

Management Options

UltraDNS offers flexible options for managing CAA records:

  • Portal Interface: A clean, intuitive UI for editing and validating CAA records.
  • API Access: Full automation support for adding or updating records via the UltraDNS REST API.
  • Zone Templates: Makes it easy to enforce consistent policies across multiple zones.

Why It Matters

CAA records are a simple but powerful security control. By explicitly stating which CAs can issue certificates for your domains, you reduce the risk of misissuance or abuse. With the upcoming requirement for S/MIME, email security now benefits from this same level of protection.

If you're issuing S/MIME certificates—or planning to—you should start publishing issuemail records ahead of the March 2025 deadline. DigiCert has already announced that it will begin enforcing these records for email certificate issuance starting March 13, 2025.

As the DNS layer becomes more central to enforcing digital trust policies, managing records like CAA should be easy, automated, and secure. UltraDNS gives you all the tools you need to stay ahead of industry changes like this one.

If you have any questions or want help getting started with issuemail records, reach out to your UltraDNS account team—we’re here to help.

Related to